Description
Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims' browsers when they interact with the contact form page.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Automattic | Jetpack | 11.4 | — |
References
- ExploitDB-51104 exploit
- Jetpack WordPress Plugin Homepage product
- VulnCheck Advisory: Jetpack 11.4 - Cross Site Scripting (XSS) third-party-advisory